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MEMORANDUM  FOR  ASSISTANT  SECRETARY  OF  DEFENSE  (COMMAND, 

CONTROL,  COMMUNICATIONS,  AND  INTELLIGENCE) 

SUBJECT:  Audit  Report  on  Sharing  Year  2000  Testing  Information  on  DoD  Information 
Technology  Systems  (Report  No.  98-074) 

We  are  providing  this  audit  report  for  review  and  comment.  We  considered 
management  comments  on  a  draft  of  this  report  in  preparing  the  final  report. 

DoD  Directive  7650.3  requires  that  all  recommendations  be  resolved  promptly. 

The  Office  of  the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications, 
and  Intelligence)  comments  were  responsive.  Based  on  management  comments,  we  added 
Recommendations  2.  and  3.  and  we  request  additional  comments  on  them  by  April  10, 
1998. 


We  appreciate  the  courtesies  extended  to  the  audit  staff.  Questions  on  the  audit 
should  be  directed  to  Ms.  Mary  Lu  Ugone,  Audit  Program  Director,  at  (703)  604-9049 
(DSN  664-9049)  or  Ms.  Virginia  Rogers,  Audit  Project  Manager,  at  (703)  604-9041 
(DSN  664-9041).  See  Appendix  C  for  the  report  distribution.  The  audit  team  members 
are  listed  inside  the  back  cover. 


Robert  J.'Lieberman 
Assistant  Inspector  General 
for  Auditing 
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(Project  No.  SAS-0004) 

Sharing  Year  2000  Testing  Information  on 
DoD  Information  Technology  Systems 


Executive  Summary 


Introduction.  The  year  2000  problem  is  the  term  most  often  used  to  describe  the 
potential  failure  of  information  technology  systems  to  process  or  perform  date-related 
functions  before,  on,  or  after  the  turn  of  the  next  century. 

This  is  one  of  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer,  DoD,  to 
monitor  DoD  efforts  to  address  the  year  2000  computing  challenge. 

Audit  Objectives.  The  audit  objective  was  to  determine  whether  planning  for  year  2000 
testing  is  adequate  to  ensure  that  mission-critical  DoD  information  technology  systems 
will  continue  to  operate  properly  after  the  year  2000.  Specifically,  the  audit  focused  on 
year  2000  management  guidance  and  testing  resources. 

Audit  Results.  The  DoD  has  designated  the  use  of  homepages  on  the  Internet  as  the 
primary  means  of  sharing  year  2000  related  information,  and  DoD  Components  have 
made  progress  in  establishing  year  2000  information  on  their  respective  homepages. 
However,  the  process  for  sharing  year  2000  testing  information  can  be  more  effective. 
DoD  Components  may  be  expending  time-sensitive  resources  inefficiently  in  solving 
the  year  2000  problem  through  the  duplication  of  efforts  and  in  attempting  to  locate 
accurate  testing  information.  The  ability  to  retrieve  and  use  all  appropriate  testing 
information  in  a  timely  and  efficient  manner  will  be  instrumental  in  the  solution  of  the 
year  2000  problem.  See  Part  I  for  details  of  the  audit  results. 

Suuimary  of  Recommeudatious.  We  recommend  establishing  within  DoD  a 
DOD-sponsored  year  2000  testing  information  center  for  collecting,  analyzing,  storing,  and 
disseminating  year  2000  related  testing  information.  We  also  recommend  providing 
year  2000  hotline  services  to  the  DoD  Components.  Further,  we  recommend  that  DoD 
Components  be  notified  of  the  testing  center’s  year  2000  role  and  responsibilities  and  of 
the  Components’  responsibility  to  share  testing  information.  Additionally,  we  recommend 
that  DoD  internet  homepages  be  organized  to  enable  users  to  quickly  and  easily  access  the 
center  for  year  2000  testing  information. 

Mauageuieut  Commeuts.  The  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  concurred  with  the  draft  recommendations,  stating  that 
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the  office  had  already  directed  the  Joint  Interoperability  Test  Command  to  maintain  a 
homepage  that  addresses  year  2000  testing  information  for  all  of  DoD.  See  Part  I  for  a 
summary  of  management  comments  and  Part  III  for  the  complete  text  of  the  comments. 

Audit  Response.  Although  we  consider  management  comments  to  be  responsive  to  the 
draft  recommendations,  our  intent  was  to  establish  a  DOD-sponsored  year  2000  testing 
information  center,  recognized  by  the  other  DoD  Components,  to  organize  and  provide 
links  to  the  year  2000  testing  information  provided  on  the  internet  by  the  DoD 
Components.  Accordingly,  we  added  recommendations  to  clarify  the  actions  needed  to 
sufficiently  identify,  publicize,  and  access  sources  of  year  2000  testing  information.  We 
request  that  the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  provide  comments  on  the  final  report  by  April  10,  1998. 
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Audit  Background 

The  year  2000  (Y2K)  problem  is  the  term  most  often  used  to  describe  the 
potential  failure  of  information  technology  systems  to  process  or  perform  date- 
related  functions  before,  on,  or  after  the  turn  of  the  century.  The  Y2K  problem 
is  rooted  in  the  way  dates  are  recorded  and  computed  in  automated  inforrnation 
systems.  For  the  past  several  decades,  systems  have  typically  used  two  digits  to 
represent  the  year,  such  as  “97”  representing  1997,  to  conserve  electronic  data 
storage  and  to  reduce  operating  costs.  With  the  two-digit  format,  however,  the 
year  2000  is  indistinguishable  from  1900,  or  2001  from  1901,  and  so  forth.  As 
a  result  of  the  ambiguity,  system  or  application  programs  that  use  dates  to 
perform  calculations,  comparisons,  or  sorting  could  generate  incorrect  results 
when  working  with  years  following  1999.  Calculation  of  Y2K  dates  is  further 
complicated  because  the  year  2000  is  a  leap  year,  the  first  century  leap  year 
since  1600.  The  computer  systems  and  applications  must  recognize 
February  29,  2000,  as  a  valid  date.  Because  of  the  potential  failure  of 
computers  to  run  or  function  throughout  the  Government,  the  General 
Accovmting  Office  has  designated  resolution  of  the  Y2K  problem  as  a  high-risk 
program. 

As  of  November  1997,  DoD  reported  3,143^  mission-critical  systems’  to  the 
Office  of  Management  and  Budget.  The  total  cost  of  the  DoD  Y2K  effort  was 
estimated  at  about  $1.5  billion. 

DoD  Year  2000  Management  Plan.  The  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and  Intelligence)  issued  the  “DoD 
Year  2000  Management  Plan”  (Management  Plan)  in  April  1997.  The 
Management  Plan  provides  the  overall  DoD  strategy  and  guidance  for 
inventorying  systems,  prioritizing  systems,  retiring  systems,  and  monitoring 
progress.  The  Management  Plan  states  that  the  DoD  Chief  Information  Officer 
has  overall  responsibility  for  overseeing  the  DoD  solution  to  the  Y2K  problem. 
Also,  the  Management  Plan  makes  the  DoD  Components  responsible  for  the 
five-phase  Y2K  management  process,  including  awareness,  assessments, 
renovations,  validations,  and  implementation  actions.  The  Management  Plan 
includes  a  description  of  the  five-phase  Y2K  management  process  and 
designates  the  Defense  Integration  Support  Tools  database  as  the  official 
repository  of  data  on  DoD  Component  information  technology  systems. 


‘The  draft  version  of  this  report  showed  2,197  mission-critical  systems  as  of 
November  1997  because  itdfl  not  include  intelligence  systems. 

*When  a  mission-critical  system’s  capabilities  are  degraded,  the  organization 
realizes  a  resulting  loss  of  a  core  capability. 
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The  DoD  Five-Phase  Management  Process.  Each  of  the  five  phases  is 
supported  by  program  and  project  management  and  represents  a  major  Y2K 
program  activity  or  segment.  TTie  April  1997  Management  Plan  shows  the 
following  target  completion  dates  for  the  five  phases  ranging  from 
December  1996  through  November  1,  1999. 

•  Phase  I  -  Awareness.  Awareness,  education,  and  initial  organization  and 
planning  take  place.  Target  completion  date:  December  1996. 

•  Phase  II  -  Assessment.  Scope  of  Y2K  effects  is  identified,  and 
system-level  analysis  takes  place.  Target  completion  date:  Jime  1997. 

•  Phase  III  -  Renovation.  Required  system  renovations  are  accomplished. 
Target  completion  date:  December  1998. 

•  Phase  IV  -  Validation.  Systems  are  certified  as  Y2K  compliant  as  a  result 
of  various  testing  and  compliance  processes.  Target  completion  date: 

Januaiy  1999. 

•  Phase  V  -  Implementation.  Systems  are  fully  operational  after  being 
certified  in  Phase  IV.  Target  completion  date:  November  1,  1999. 

The  Assistant  Secretary  of  Defense  (Command,  Control,  Commimications,  and 
Intelligence)  is  in  the  process  of  issuing  an  updated  Management  Plan,  which 
accelerates  the  target  completion  dates  for  the  Renovation,  Validation,  and 
Implementation  phases. 

Defense  Integration  Support  Tools  Database.  The  Defense  Integration 
Support  Tools  database,  maintained  by  the  Defense  Information  Systems 
Agency,  contains  the  official  DoD  inventory  of  DoD  Component  information 
technology  systems.  The  database  contains  information  on  hardware  platforms, 
operating  systems,  applications  languages,  communications,  and  interfaces. 
Originally  designed  to  support  the  planning  and  execution  of  the  DoD 
automated  information  system  migration  strategy,  the  Management  Plan  states 
that  DoD  Components  should  use  the  Defense  Integration  Support  Tools 
database  to  track  Y2K  compliance  and  to  support  management  decisions. 


Audit  Objectives 


The  overall  audit  objective  was  to  determine  whether  planning  for  Y2K  testing 
is  adequate  to  ensure  that  mission-critical  DoD  information  technology  systems 


^The  strategy  related  to  existing  or  planned  and  approved  automated  information 
systems  that  have  been  officially  designated  as  the  automated  information 
system  to  support  standard  functional  processes.  ^ 
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will  continue  to  operate  properly  after  the  Y2K.  Specifically,  the  audit  focused 
on  Y2K  management  guidance  and  testing  resources.  See  Appendix  A  for  a 
discussion  of  the  audit  scope  and  methodology. 
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Sharing  Year  2000  Testing  Information 
on  DoD  Information  Technology  Systems 

The  DoD  has  designated  the  use  of  homepages  on  the  Internet  as  the 
primary  means  of  sharing  Y2K  related  information,  and  DoD 
Components  have  made  progress  in  establishing  Y2K  information  on 
their  respective  homepages.  However,  the  process  for  sharing  Y2K 
testing  information  can  be  more  effective. 

Sharing  of  testing  information  is  not  as  effective  as  possible  because  the 
DoD  decentralized  strategy  for  collecting,  storing,  and  distributing  Y2K 
testing-related  information  is  inadequate.  Further,  the  testing 
mformation  available  on  the  Internet  is  not  in  an  organized  format. 

As  a  result,  DoD  may  be  expending  time-sensitive  resources  inefficiently 
in  solving  the  Y2K  problem  through  the  duplication  of  efforts  and  in 
attempting  to  locate  accurate  testing  information.  The  ability  to  retrieve 
and  use  all  appropriate  testing  information  in  a  timely  and  efficient 
manner  will  be  instrumental  in  the  solution  of  the  Y2K  problem. 


DoD  Policy  on  Coordinating  Year  2000  Information 

DoD  policy  for  resolving  the  Y2K  problem,  as  stated  in  the  Management  Plan, 
assigns  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence),  who  is  also  the  DoD  Chief  Information 
Officer,  with  the  overall  responsibility  for  overseeing  the  DoD  solution  to  the 
Y2K  problem  and  assigns  the  DoD  Components  with  the  responsibility  for 
implementation.  The  Management  Plan  states  that  the  policy  allows  DoD 
Components  the  flexibility  to  implement  solutions  as  deemed  appropriate  while 
benefiting  from  best  practices  in  a  coordinated  effort. 

To  reduce  duplication  of  effort  and  to  leverage  Y2K  experiences,  the 
Management  Plan  states  that  information  on  Y2K  problems,  best  practices,  and 
lessons  learned  will  be  shared  among  the  DoD  Components  and  with 
Govermnent  agencies  and  the  private  sector.  The  primary  sharing  media  for 
this  effort  are  the  Y2K  public  and  restricted  homepages  on  the  Internet. 


Year  2000  Information  Available  on  the  Internet 

The  Y2K  testing  information  shared  on  the  Internet  is  tailored  for  individual 
DoD  Component  requirements  and  is  not  organized  for  implementing  Y2K 
solutions  from  an  overall  DoD  perspective.  Additionally,  it  is  difficult  for  DoD 
Component  personnel  to  locate  relevant  and  accurate  Y2K  test-related 
information. 
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DoD  Homepage.  The  DoD  homepage,  DefenseLINK,  does  not  contain  a  direct 
link  (connection  from  one  Internet  site  to  another)  to  issues  related  to  the  Y2K 
problem.  DefenseLINK,  the  World  Wide  Web  Information  Service  froin  DoD, 
contains  links  to  the  Secretary  of  Defense,  Joint  Chiefs  of  Staff,  the  National 
Guard,  the  Army,  the  Navy,  the  Air  Force,  the  Marine  Corps,  other 
organizations,  and  other  information.  Using  the  search  capability  of  die 
DefenseLINK  homepage,  we  searched  for  “Y2K”  (the  commonly  used  acronym 
for  year  2000)  and  “year  2000.  ”  Only  the  “year  2000”  search  yielded  a  total 
of  61  references  of  which  1,  “Raising  Awareness  of  the  Year  2000  Computer 
Problem,”  pertained  to  the  DoDY2K  program. 

The  first  reference  to  the  DoD  Y2K  program,  starting  from  the  DoD  homepage, 
is  found  on  the  homepage  for  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence).  From  that  homepage,  selecting 
“Year  2000  Program”  provides  a  link  to  the  Defense  Information  Systems 
Agency  Y2K  homepage  which,  in  turn,  provides  links  to  the  Army,  Navy, 

Air  Force,  Marine  Corps,  and  Defense  Logistics  Agency  Y2K  homepages. 

DoD  Component  Year  2000  Homepages.  While  the  Y2K  homepages  of  the 
Army,  the  Navy,  the  Air  Force,  and  the  Defense  Information  Systems  Agency 
contain  a  wide  variety  of  Y2K-related  information,  the  information  is  difficult 
to  find,  requiring  extensive  searches  through  multiple  layers  of  linked 
homepages.  Additionally,  none  of  the  Y2K  homepages  has  a  search  capability 
focused  on  Y2K  test  information;  therefore,  DoD  Components  have  to  search 
through  multiple  layers  of  linked  homepages  to  find  needed  information.  The 
DoD  Component  homepages  also  do  not  provide  an  index  of  information 
available  on  a  particular  site  to  assist  in  locating  specific  information.  Finally, 
the  Components’  homepages  do  not  provide  information  on  hotline-tjqie  services 
for  Y2K  problems.  While  telephone  and  electronic  mail  services  are  normally 
provided  on  a  homepage,  those  services  are  not  provided  by  a  centralized 
facility  to  use  technical  expertise  or  emergency  assistance  on  a  DoD-wide  basis. 

General  Internet  Search.  As  we  near  the  turn  of  the  century,  the  amount  of 
Y2K  testing-related  information  on  the  Internet  will  increase  dramatically.  The 
addition  of  testing  information  in  an  unorganized  format  to  the  Internet  will 
further  complicate  the  ability  to  locate  information.  Our  search  of  the  Internet 
for  selected  year  2000  terms  yielded  the  following. 
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Internet  Search  Results  on  Year 

2000  Information 

Term 

Matches 

year  2000 

262,176 

Y2K 

12,437 

year  2000  compliance 

7,275 

Y2K  compliance 

1,160 

year  2000  testing 

1,542 

Y2K  testing 

312 

While  the  sheer  volume  of  data  precludes  a  detailed  analysis,  the  relatively 
small  number  of  matches  for  Y2K  testing-related  information  (“year  2000 
testing”  and  “Y2K  testing”)  suggests  that  most  of  the  data  pertain  to  Y2K 
awareness  and  assessment  topics.  More  awareness  and  assessment  information 
than  testing  information  may  be  available  because  DoD  and  other  Federal 
agencies  are  just  moving  into  the  renovation  and  validation  phases  of  the  Y2K 
management  process. 


Importance  of  the  Validation  Phase 

The  validation  phase  is  the  most  critical  of  the  DoD  Y2K  five-phase  process 
because  during  that  phase,  systems  are  tested  to  verify  that  they  will  operate 
correctly  into  the  next  century.  If,  as  stated  in  the  Management  Plan,  DoD 
plans  to  leverage  Y2K  experiences,  DoD  management  will  have  to  make 
substantive  changes  to  the  strategy  of  centralized  policy  and  decentralized 
implementation.  Specifically,  changes  are  required  in  the  ways  that  Y2K 
testing-related  information  is  collected,  stored,  and  distributed  on  a  DoD-wide 
basis.  The  DoD  Components  should  provide  the  necessary  information  on  the 
Internet  in  an  easily  accessible  format. 

Best  Practices  and  Lessons  Learned.  The  Management  Plan  states  that 
information  on  best  practices  and  lessons  learned  will  be  shared  on  Internet 
homepages  to  reduce  the  duplication  of  effort  and  to  leverage  Y2K  experience. 
However,  we  located  1  site  for  best  practices  and  10  sites  for  lessons  learned, 
which  is  very  few  considering  the  vast  number  of  systems,  personal  computers, 
and  software  used  by  the  Services  and  the  Defense  Information  Systems 
Agency.  The  only  site  we  found  that  referenced  best  practices  was  the  Social 
Security  Administration  Best  Practices.  Although  the  sites  were  not  specifically 
named  “lessons  learned,”  the  Navy  Y2K  homepage  included  links  to  three  sites 
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that  described  lessons  learned  from  testing.  The  Defense  Information  Systems 
Agency  Y2K  homepage  contained  a  link  to  seven  sites  that  described  lessons 
learned.  The  Air  Force  and  Army  Y2K  homepages  did  not  contain  sites  for 
lessons  learned. 

Status  of  Defense-Wide  Systems.  Several  systems  provide  for  transmitting  or 
processing  information  on  a  Defense-wide  basis.  The  systems  include  the 
Defense  Message  System,  the  Global  Command  and  Control  System,  the 
Defense  Information  Infrastructure  Common  Operating  Environment,  and  the 
Defense  Megacenters.  Renovation  and  testing  of  the  systems  is  critical  because 
they  connect  with  many  DoD  Component  systems  that  cannot  be  certified  as 
Y2K-compliant  imtil  their  interfaces  are  fully  tested. 

The  Defense  Information  Systems  Agency  homepage  lists  the  systems 
mentioned  above  as  “core  mission  areas,  ”  but  it  contains  limited  information  on 
the  current  certification  status  of  the  systems.  The  Defense  Information 
Systems  Agency  Y2K  homepage  contains  a  link  to  a  site  that  lists  the  status  of 
the  Defense  Megacenters,  but  it  has  not  been  updated  since  1996.  The 
homepage  contains  no  reference  to  the  other  three  core  mission  areas. 

The  only  other  information  that  we  found  on  the  status  of  Y2K  certification  for 
the  systems  of  the  core  mission  areas  was  on  the  Joint  Interoperability  Test 
Command  Y2K  homepage.  The  Joint  Interoperability  Test  Command  Y2K 
homepage  connects  to  a  site,  “Y2K  Test  Results,”  which  states  that  the  results 
of  the  Y2K  testing  are  coordinated  off-line  for  five  systems,  including  the 
Global  Command  and  Control  System  and  the  Defense  Message  System. 

Commercial  Off-the-Shelf  Products.  Multiple  sites  provide  compliance 
information  on  commercial  off-the-shelf  products;  however,  the  information 
may  not  be  valid.  The  various  DoD  Component  homepages  generally  lead  the 
user  to  a  page  that  lists  vendor-supplied  claims  of  compliance  information  for 
commercial  off-the-shelf  products.  Some  of  the  sites  also  provide  warnings 
regarding  the  accuracy  of  the  compliance  information.  For  example,  the  Y2K 
compliance  status  list  maintained  by  the  Government  Information  Technology 
Executive  Coimcil  states: 

While  striving  for  accuracy  and  timeliness,  GITEC  [Government 
Information  Technology  Executive  Council]  cannot  guarantee 
accuracy  nor  indemnify  users  from  actions  related  to  the  use  of  this 
data. 

The  commercial  off-the-shelf  information  provided  by  the  MITRE  Corporation 
comes  with  the  following  warning: 

Much  of  the  information  on  century  compliance  is  still  incomplete  and 
unverified  . . .  Neither  the  MITRE  Corporation,  nor  the  Federal 
Government,  makes  any  endorsements,  guarantees  or  warranties  as  to 
the  accuracy  or  completeness  of,  or  results  to  be  obtained  from, 
accessing  and  using  this  MITRE  Corporation  information,  or  for  any 
damages  resulting  therefrom. 


8 


Sharing  Year  2000  Testing  Information  on  DoD  Information  Technology  Systems 

The  current  process  of  distributing  Y2K  compliance  data  for  commercial  off- 
the-shelf  products  presents  two  potential  problems  for  DoD.  First,  the 
information  being  distributed  may  be  of  limited  value  because  it  is  incomplete, 
and  second,  it  may  be  used  improperly  to  certify  mission-critical  systems  as 
being  Y2K  compliant. 

Validity  of  Vendor  Supplied  Data.  Because  vendor  claims  on  the 
compliance  of  commercial  off-the-shelf  products  can  be  incomplete  or 
erroneous,  the  information  may  have  little  real  value  to  system  management  and 
technical  staff.  A  more  useful  method  would  be  to  cross-reference  the  vendor 
claim  to  DoD  user  experiences  with  the  product,  creating  a  comprehensive 
repository  of  lessons  learned  on  specific  products.  That  method  would  allow 
individuals  needing  information  about  a  specific  product  to  benefit  from  the 
experience  of  others  as  well  as  to  provide  a  place  to  submit  information  on 
pitfalls  that  others  could  avoid.  However,  we  did  not  find  this  type  of 
information  available  during  our  Internet  search. 

Certification  Process.  The  validity  of  vendor-supplied  data  is  important 
because  the  certification  process  in  the  Management  Plan  allows  system 
managers  to  self-certify  their  information  tecluiology  systems  based  on  vendor 
claims  of  compliance  without  independent  testing.  An  in-depth  analysis  of  the 
Y2K  certification  process  will  be  presented  in  a  separate  Inspector  General, 

DoD,  report. 

Year  2000  Testing  Facilities.  A  list  of  facilities  with  Y2K  testing  capabilities 
that  could  assist  a  systems  manager  in  determining  how  or  where  a  system  could 
be  tested  for  Y2K  compliance  is  not  available  on  the  Internet.  According  to  its 
homepage,  the  Joint  Interoperability  Test  Command,  Fort  Huachuca,  Arizona, 
is  the  only  Defense  Information  Systems  Agency-approved,  full-service  Y2K 
tester.  While  there  are  Y2K  information  links  from  the  Defense  Information 
Systems  Agency  Y2K  homepage  to  the  Army  Technology  Integration  Center, 
the  Air  Force  Systems  Support  Group,  and  Ae  Air  Force  Software  Technology 
Support  Center,  none  of  those  organizations  are  specifically  designated  as  a 
Y2K  testing  facility.  We  did  not  find  any  direct  links  to  a  Navy  Y2K  test 
facility. 


Need  for  Centralized  Compilation  of  Year  2000  Testing 
Information 

Although  the  DoD  Components  have  made  progress,  the  process  for  resolving 
the  Y2K  problem  is  not  fully  effective.  Until  information  technology  systems 
are  adequately  tested,  DoD  management  cannot  be  assured  that  mission-critical 
systems  will  continue  to  operate  properly  into  the  next  century.  Reliable  and 
relevant  testing  information  on  commercial.  Government,  and  mission-unique 
systems  needs  to  be  well  organized  and  made  readily  available  to  the  DoD 
Components. 

Sharing  Year  2000  Testing  Information.  The  DoD  has  not  effectively  used 
the  Internet,  a  potentially  invaluable  resource  for  Y2K-related  information,  to 
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disseminate  Y2K  testing  information  in  an  organized  or  coordinated  manner.  To 
obtain  Y2K  information,  users  may  expend  vast  amounts  of  time  searching 
through  a  loosely  organized  array  of  links  to  sites  that  may  contain  data  ranging 
from  useful  to  outdated  or  that  loop  back  to  the  original  location.  Additionally, 
the  user  may  arrive  at  identical  sites  from  different  starting  points,  resulting  in 
the  loss  of  valuable  time. 

Finding  reliable  information  on  corporate  information  technology  systems,  Y2K 
test  facilities,  best  practices,  lessons  learned,  or  compliance  of  common 
computer  software  and  hardware  products  is  unnecessarily  difficult.  In  the  short 
time  remaining  to  repair  or  replace  DoD  mission-critical  systems  before  the 
beginning  of  the  next  century,  users  should  not  have  to  sift  through  hundreds  of 
references  to  find  the  information  they  need  to  certify  their  information 
technology  systems  as  Y2K  compliant.  The  time  factor  will  become  more 
critical  as  the  turn  of  the  century  approaches  and  system  managers  find 
themselves  needing  emergency  assistance  either  to  fix  system  failures  or  to  keep 
the  systems  from  imminent  failure. 

Single  Source  of  Information.  The  ability  of  most  information  technology 
systems  to  operate  correctly  into  the  next  century  caimot  be  reliably  determined 
without  comprehensive  testing.  The  DoD  does  not  have  a  single  facility 
designated  to  provide  system  managers  and  technical  persoimel  with  the  most 
current  and  accurate  Y2K  information  and  technical  assistance  on  testing 
requirements,  facilities,  tools,  best  practices,  lessons  learned,  or  results.  Such  a 
facility  could  also  provide  hotline  services  to  answer  questions  or  to  coordinate 
requests  for  emergency  assistance.  Further,  the  facility  could  also  be  used  to 
gather  and  disseminate  post-Y2K  related  information. 


Recommendations,  Management  Comments,  and  Audit 
Response 

Added  Recommendations.  As  a  result  of  management  comments,  we  added 
Recommendations  2.  and  3.  to  clarify  the  actions  needed  to  sufficiently  identify 
and  publicize  sources  of  Y2K  testing  information  for  the  DoD  Components. 

We  renumbered  the  original  recommendations  accordingly. 

1.  We  recommend  that  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  establish  a  DOD-sponsored  year 
2000  testing  information  center  within  DoD.  The  center  should  be 
responsible  for: 

a.  Gathering,  analyzing,  storing,  and  disseminating  reliable  and 
relevant  year  2000  testing  information. 

b.  Providing  year  2000  hotline  services  to  DoD  Components. 

Management  Comments.  The  Office  of  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Commimication,  and  Intelligence)  concurred  with  the 
recommendation,  stating  that  the  office  had  already  directed  the  Joint 
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Interoperability  Test  Conunand  within  the  Defense  Information  Systems  Agency 
to  maintain  a  homepage  that  addresses  Y2K  testing  information  for  all  of  DoD. 
The  homepage  contains  test  methods,  vendor-provided  data,  lessons  learned, 
and  links  to  Y2K  tools  and  other  Y2K  homepages.  The  Joint  Interoperability 
Test  Command  does  not  have  a  formal  hotline  service;  however,  it  does  have  a 
list  of  points  of  contact.  See  Part  I  for  a  summary  of  management  comments 
and  Part  III  for  the  complete  text  of  the  comments. 

Audit  Response.  Although  we  consider  management  comments  to  be 
responsive  to  the  draft  recommendations,  our  intent  was  to  establish  a 
DOD-sponsored  Y2K  testing  information  center,  recognized  by  the  other  DoD 
Components,  to  organize  and  provide  links  to  the  Y2K  testing  information 
provided  on  the  internet  by  the  DoD  Components.  As  the  number  of  systems 
being  tested  increases,  the  accessibility  of  Y2K  testing  information  becomes 
more  critical.  We  believe  there  is  confusion  on  where  to  obtain  Y2K  testing 
information.  For  example,  an  individual  from  the  Marine  Corps  requested 
information  from  the  Office  of  the  Inspector  General,  DoD,  on  how  to  test  its 
computers  for  Y2K  compliance. 

2.  We  recommend  that  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  formally  notify  the  DoD 
Components  that: 

a.  The  Joint  Interoperability  Test  Command  is  the  DOD-sponsored 
year  2000  testing  information  center. 

b.  The  Joint  Interoperability  Test  Command  is  responsible  for 
fielding  questions  and  providing  information  on  year  2000  testing. 

c.  DoD  Components  should  provide  year  2000  testing  information, 
internet  sites,  or  both,  on  best  practices,  lessons  learned,  compliance  of  the 
Defense-wide  systems,  commercial  off-the-shelf  products,  and  year  2000 
testing  facilities,  to  llie  Joint  Interoperability  Test  Command. 

3.  We  recommend  that  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  establish  links  on  the  internet 
from  high-level  DoD  homepages  that  allow  DoD  personnel  searching  for 
year  2000  testing  information  to  quickly  and  easily  obtain  the  information 
gathered  by  the  Joint  Interoperability  Test  Command. 

Management  Comments  Required.  We  added  Recommendations  2.  and  3.  to 
clarify  the  intent  of  our  draft  recommendation.  We  request  that  the  Assistant 
Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
provide  comments  on  the  added  recommendations  by  April  10,  1998. 
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Part  II  -  Additional  Information 


Appendix  A.  Audit  Process 


Scope 

This  is  one  of  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  year  2000  computing  challenge. 

For  a  listing  of  audit  projects  addressing  this  issue,  see  the  Y2K  webpage  on 
IGNET  (http://www.ignet.gov/). 


We  reviewed  and  evaluated  the  DoD  Year  2000  Management  Plan  issued  by  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  in  April  1997.  In  addition,  we  determined  the  extent  to  which 
DoD  Components  used  the  Internet  to  share  Y2K-related  information  as  of 
October  1997.  We  reviewed  Y2K-related  information  on  the  DefenseLINK 
homepage  and  performed  a  search  using  Y2K  key  words.  We  also  performed  a 
general  search  of  the  Internet  using  Y2K  key  words.  We  reviewed  the 
Y2K-related  information  provided  on  the  Y2K  homepages  for  the  Defense 
Information  Systems  Agency,  the  Joint  Interoperability  Test  Command,  tbe 
Air  Force,  the  Army,  and  the  Navy  and  reviewed  the  various  connecting  litiks 
to  Y2K  sites.  Specifically,  we  determined  the  accessibility  of  the  Y2K-related 
information  and  the  availability  of: 

•  information  on  the  best  practices  and  lessons  learned  regarding  testing 
of  systems  and  software; 

•  information  on  the  Defense  Message  System,  the  Global  Command 
and  Control  System,  the  Defense  Information  Infrastructure  Common  Operating 
Environment,  and  the  Defense  Megacenters; 

•  Y2K  compliance  information  on  commercial  off-the-shelf 
products;  and 

•  information  on  Y2K  testing  facilities. 


Methodology 

Use  of  Computer-Processed  Data.  No  computer-processed  data  were  used 
during  the  audit. 

Audit  Type,  Dates,  and  Standards.  We  performed  this  program  audit  from 
October  to  November  1997  in  accordance  with  auditing  standards  issued  by  the 
Comptroller  General  of  the  United  States,  as  implemented  by  the  Inspector 
General,  DoD. 
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Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  the  DoD.  Further  details  are  available  on  request. 

Management  Control  Program.  We  did  not  review  the  management  control 
program  in  depth  because  the  DoD  has  already  reported  the  Y2K  problem  as  a 
material  control  weakness.  The  finding  in  this  report  does  relate  to  a  specific 
management  control  weakness;  however,  separate  reporting  of  that  weakness 
would  be  unnecessary. 
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General  Accounting  Office 

The  General  Accounting  Office  has  conducted  several  audits  related  to  Y2K 
issues.  The  audits  are  summarized  below. 

General  Accounting  Office  Report  No.  AIMD-98-35  (OSD  Case  No.  1484), 
“Defense  Computers:  Air  Force  Needs  to  Strengthen  Year  2000 
Oversight,”  January  16,  1998.  Congress  requested  the  review  of  the  Air 
Force  Y2K  program.  The  review  focused  on  Air  Force  oversight  of  its  Y2K 
program  and  the  appropriateness  of  its  strategy  and  actions  for  ensuring  that  the 
Air  Force  will  successfully  address  the  Y2K  problem.  The  Air  Force  has  taken 
a  number  of  positive  actions  toward  fulfilling  its  Y2K  oversight  responsibilities. 
At  the  same  time,  the  Air  Force  had  not  yet  adequately  addressed  several 
critical  issues  that  would  ensure  that  it  is  well-positioned  to  deal  with  the  later, 
and  more  difficult,  phases  of  Y2K  correction.  The  review  showed  that  some 
Air  Force  components  are  not  adequately  planning  for  the  testing  phase  of  their 
Y2K  effort  and  developing  contingency  plans.  Some  Air  Force  components  are 
also  taking  conflicting  approaches  toward  determining  the  actual  impact  of  the 
program  status  to  their  system  interfaces.  If  the  Air  Force  does  not  promptly 
address  and  take  consistent  action  on  those  issues,  it  may  well  negate  any 
success  it  may  have  in  making  its  systems  Y2K  compliant.  While  the  Air  Force 
has  enlisted  the  help  of  the  Air  Force  Audit  Agency  to  address  some  of  those 
concerns,  the  Air  Force  must  continue  its  comprehensive  oversight  to  ensure 
that  it  can  address  unforeseen  problems  and  delays  in  the  next,  more  difficult 
phase. 

General  Accounting  Office  Correspondence  Report  No.  AIMD-98-7R  (OSD 
Case  No.  1471),  “Defense  Computers:  Technical  Support  Is  Key  to  Naval 
Supply  Year  2000  Success,”  October  21,  1997.  The  report  states  that  Naval 
Supply  Systems  Command  had  not  allocated  sufficient  resources  to  the  Fleet 
Material  Support  Office  Year  2000  Project  Office  to  ensure  that  all  systems 
interfaces  were  identified  and  adequately  monitored  for  progress.  Also,  Naval 
Supply  Systems  Command  had  not  directed  that  risk  assessments  be  performed 
or  that  contingency  plans  be  prepared  at  the  system  and  functional  levels.  As  a 
result  of  the  concerns  that  the  General  Accounting  Office  raised.  Naval  Supply 
Systems  Command  and  Fleet  Material  Support  Office  officials  have  begun 
addressing  system  interface  issues  by  assigning  full-time  staff  to  identify  date- 
related  data  elements  in  interface  files  and  to  ensure  that  date  formats  are 
compatible.  The  actions,  together  with  Naval  Supply  Systems  Command’s 
plans  for  requiring  systems  managers  to  perform  risk  assessments  and  develop 
contingency  plans  for  critical  systems,  should  help  mitigate  the  loss  of 
operational  capability  at  the  year  2000.  As  Naval  Supply  Systems  Command 
progresses  to  the  renovation,  validation  (testing),  and  implementation  phases  of 


16 


Appendix  B.  Prior  Coverage  and  Related  Publications 


the  Y2K  program,  it  must  pay  continued  attention  to  those  issues  to  better 
ensure  that  the  year  2000  challenge  is  met.  The  Director,  Test,  Systems 
Engineering  and  Evaluation,  concurred  with  a  draft  of  this  report. 

General  Accounting  Office  Report  No.  AIMD-97-149  (OSD  Case  No.  1446), 
“Defense  Computers:  Logistics  Systems  Support  Center  Needs  to  Confront 
Significant  Year  2000  Issues,”  September  26,  1997.  The  report  states  that 
while  Y2K  improvement  efforts  have  been  initiated  by  the  Logistics  Systems 
Support  Center  on  its  Commodity  Command  Standard  System  program,  the 
Logistics  Systems  Support  Center  has  not  completed  several  key  project 
management  actions  associated  with  the  assessment  phase.  As  a  result,  the 
Logistics  Systems  Support  Center  is  not  presently  well-positioned  to  move  to  the 
more  difficult  phases  of  renovation,  validation,  and  implementation  in  the  Y2K 
process  phases  that  industry  experts  estimate  could  consume  as  much  as  three- 
fourths  of  Y2K  project  time  and  resources.  The  report  recommends  that  the 
Logistics  Systems  Support  Center  still  needs  to  take  a  number  of  actions  to 
increase  its  chances  of  success,  including  managing  competing  workload 
priorities,  planning  for  testing,  clarifying  and  coordinating  written  systems 
interface  agreements,  and  developing  a  contingency  plan.  To  increase  its 
chances  of  successfully  managing  its  Y2K  program,  the  Logistics  Systems 
Support  Center  will  also  need  to  institutionalize  a  repeatable  software  change 
process  that  can  be  used  from  project  to  project.  Given  the  prominence  of  date 
processing  in  the  Commodity  Command  Standard  System  and  its  central  mission 
of  sustaining  the  solider  in  the  field,  the  Logistics  Systems  Support  Center 
cannot  delay  any  longer,  and  must  demonstrate  that  it  will  perform  all  the  key 
actions  associated  with  sound  Y2K  planning  and  management.  The  Director, 
Test,  Systems  Engineering  and  Evaluation,  concurred  with  a  draft  of  the  report. 

General  Accounting  Office  Correspondence  Report  No.  AIMD-97-120R 
(OSD  Case  No.  1399),  “Defense  Computers:  Standard  Systems  Group 
Needs  to  Sustain  Year  2000  Progress,”  August  19,  1997.  The  report  states 
that  the  Standard  Systems  Group  must  further  emphasize  management  and 
oversight  of  systems  interfaces  to  ensure  successful  implementation  of  Y2K- 
compliant  systems  throughout  its  user  community.  Also,  a  number  of  Standard 
Systems  Group  systems  must  use  standard  interface  message  formats  to 
exchange  data  that  are  defined  by  external  entities  outside  the  control  of  the 
Standard  Systems  Group.  Some  of  the  message  formats  had  not  been  finalized 
by  the  organizations  responsible  for  their  definition.  Recently,  officials  from 
the  Standard  Systems  Group’s  Year  2000  Project  Office  began  addressing  the 
interface  issue.  If  effectively  implemented  by  the  project  office,  the  effort 
should  be  a  positive  step  toward  preventing  loss  of  operational  capabilities 
between  the  Standard  Systems  Group’s  internal  and  external  systems’  interface 
message  formats  at  the  year  2000.  The  Air  Force  Director,  Communications 
and  Information,  concurred  with  a  draft  of  the  report. 

General  Accounting  Office  Report  No.  AIMD-97-112  (OSD  Case  No.  1395), 
“Defense  Computers:  Improvements  to  DoD  Systems  Inventory  Needed  for 
Year  2000  Effort,”  August  13,  1997.  The  report  states  that  while 
improvement  efforts  have  been  initiated,  the  Defense  Integration  Support  Tools 
database  will  not  be  usable  and  reliable  in  time  to  have  a  beneficial  impact  on 
Y2K  correction  efforts.  The  Defense  Integration  Support  Tools  contains  the 
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DoD-wide  inventory  of  automated  information  systems.  The  report 
recommended  investigation  of  all  duplicate,  inactive,  and  incomplete  entries; 
expedited  development  and  implementation  of  the  purging  inethodology;  and 
expansion  of  information  contained  in  the  database  for  individual  systems  to 
include  key  program  activity  schedules  that  managers  of  interfacing  systems 
need  to  ensure  that  their  systems’  interfaces  are  maintained  during  the 
renovation  phase.  The  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  concurred  with  the  recommendations  and 
stated  that  DoD  plans  to  take  corrective  action  by  performing  statistical 
sampling  of  the  Defense  Integration  Support  Tools  database  to  validate 
accuracy. 

General  Accounting  Office  Report  No.  AIMD-97-106  (OSD  Case  No.  1389), 
“Defense  Computers:  Issues  Confronting  Defense  Logistics  Agency  in 
Addressing  Year  2000  Problems,”  August  12,  1997.  The  report  states  that 
the  Defense  Logistics  Agency  had  already  assessed  the  Y2K  impact  on  its 
operations;  inventoried  its  systems;  conducted  pilot  projects  to  determine  Y2K 
effects  on  some  of  its  major  systems;  and  developed  and  issued  policies, 
guidelines,  standards,  and  recommendations  on  Y2K  correction  for  the  agency. 
The  Defense  Logistics  Agency  had  not  prioritized  the  86  automated  information 
systems  that  it  plans  to  have  operational  in  the  year  2000  to  ensure  that  mission- 
critical  systems  are  corrected  first.  In  addition,  the  Defense  Logistics  Agency 
had  not  developed  contingency  plans  in  the  event  that  any  of  the  systems  cannot 
he  corrected  on  time.  The  report  recommended  that  the  Defense  Logistics 
Agency  complete  signed,  written  interface  agreements  detailing  data  exchange 
methods;  develop  a  Y2K  systems  prioritization  plan;  and  prepare  contingency 
plans  for  all  critical  systems.  The  Under  Secretary  of  Defense  for  Acquisition 
and  Technology  concurred  with  the  recommendation  on  interface  agreements 
and  contingency  plans  but  did  not  concur  with  the  recommendation  on  systems 
prioritization,  stating  that  the  Defense  Logistics  Agency  planning  efforts  and 
strategy  for  renovating  its  systems  are  adequate.  The  Defense  Logistics  Agency 
is  in  the  process  of  ensuring  that  documented  agreements  are  prepared  for  all 
interfaces  requiring  changes  between  their  interface  partners.  Completion  was 
expected  in  September  1997.  The  Defense  Logistics  Agency  is  also  in  the 
process  of  preparing  contingency  plans  within  each  business  area  focusing  on 
those  systems  that  Y2K  will  affect.  Initial  plans  were  to  be  prepared  by  October 
1997. 

General  Accounting  Office  Report  No.  AIMD-97-117  (OSD  Case  No.  1392), 
“Defense  Computers:  Defense  Finance  and  Accounting  Service  Faces 
Challenges  in  Solving  the  Y2K  Problems,”  August  11,  1997.  The  report 
states  that  the  Defense  Finance  and  Accoimting  Service  had  developed  a  Y2K 
strategy  consistent  with  the  DoD  Y2K  Management  Plan  and  has  defined 
conditions  that  automated  information  systems  must  meet  to  obtain  certification 
as  Y2K  compliant.  However,  the  Defense  Finance  and  Accounting  Service  had 
not  identified  all  critical  tasks  for  achieving  Y2K  objectives,  established 
milestones  for  completing  all  tasks,  performed  formal  risk  assessments  of  all 
systems  to  be  renovated,  or  prepared  contingency  plans  in  the  event  that 
renovations  are  not  completed  in  time  or  fail  to  operate  properly.  The  report 
also  states  that  the  Defense  Finance  and  Accounting  Service  had  not  identified 
all  system  interfaces  and  had  completed  only  230  of  904  written  agreements 
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with  interface  partners.  Further,  the  Defense  Finance  and  Accoimting  Service 
had  not  adequately  ensured  that  testing  resources  will  be  available  to  detemune 
whether  all  operational  systems  are  compliant  before  the  year  2000.  The  report 
recommended  that  the  Defense  Finance  and  Accounting  Service  identify  Y2K 
program  actions  and  milestones,  issue  guidance  to  ensure  continuity  of 
operations,  identify  external  interfaces  and  obtain  written  agreements  describing 
the  method  of  data  exchange,  and  devise  a  testing  schedule  to  ensure  that  all 
systems  can  operate  in  a  Y2K  environment.  The  Under  Secretary  of  Defense 
(Comptroller)  conciured  with  the  recommendations.  The  Defense  Finance  and 
Accounting  Service  agreed  to  update  its  existing  Year  2000  Executive  Plan  and 
its  Corporate  Contingency  Plan.  It  also  agreed  to  have  all  written  interface 
agreements  with  interface  partners  in  place  by  September  30,  1997,  and  to  fully 
implement  its  certification  process  for  ensuring  that  all  systems  are  Y2K 
compliant.  Further,  the  Defense  Finance  and  Accounting  Service  agreed  to 
devise  a  testing  schedule  that  identifies  the  test  facilities  and  resources  needed 
for  performing  proper  testing  of  its  systems  in  a  Y2K  environment. 

General  Accounting  Office  Publications.  Among  the  publications  that  the 
General  Accounting  Office  issued  relating  to  the  Y2K  problem  are  the 
“Year  2000  Computing  Crisis:  An  Assessment  Guide,”  Exposure  Draft 
(GAO/ AIMD-10. 1.14),  February  1997;  and  the  “Year  2000  Computing  Crisis: 
Audit  Program  Guide,  ”  Exposure  Draft  (GAO/AIMD-10.1.17),  June  1997. 

The  assessment  guide  provides  a  framework  and  a  checklist  for  assessing  the 
readiness  of  Federal  agencies  to  achieve  Y2K  compliance.  The  assessment 
guide  provides  information  on  the  scope  of  the  challenge  and  offers  a  structured 
approach  for  reviewing  the  adequacy  of  agency  planning  and  management  of  the 
Y2K  program.  The  audit  program  guide  provides  information  technology 
system  auditors  with  more  detailed  guidelines  to  use  in  reviewing  individual 
agency  efforts  in  solving  Y2K  issues. 


Inspector  General,  DoD 

Inspector  General,  DoD,  Rraort  No.  98-065,  “DoD  Information  Technology 
SoMitations  and  Contract  Compliance  for  Year  2000  Requirements,” 
February  6,  1998.  The  review  focuses  on  the  compliance  of  DoD  information 
technology  solicitations  and  contracts  with  Federal  Acquisition  Regulation 
section  39.106,  “Y2K  Compliance.”  The  report  states  that  20  of  the  reviewed 
35  indefmite-delivery/indefmite-quantity  and  indefinite-delivery-requirement 
information  technology  contracts  (for  commercial  off-the-shelf  products)  did  not 
have  the  required  Federal  Acquisition  Regulation  Y2K  compliance  language, 
and  none  of  the  35  contracts  required  testing  of  purchased  products.  As  a 
result,  DoD  has  no  assurance  that  information  technology  products  purchased 
were  Y2K  compliant.  Further,  the  purchase  of  noncompliant  products  may 
seriously  hamper  the  ability  of  DoD  to  perform  its  administrative  and 
warfighting  mission  requirements.  Additionally,  because  33  of  the  35  contracts 
are  available  for  use  by  other  Federal  agencies,  nonconforming  contract  items 
could  negatively  affect  the  ability  of  the  Federal  Government  to  survive  the 
Y2K  crisis.  After  the  audit  results  briefing,  the  Acting  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence)  and  the 
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Director,  Defense  Procurement,  drafted  new  guidance  for  the  DoD  Components 
that  would  require  Y2K-compliant  information  technology  and  testing  of  items 
purchased  from  the  information  technology  contracts.  The  guidance  was  later 
signed  by  the  Acting  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence).  In  addition.  Army,  Navy,  and  Air  Force 
contracting  officers  completed  the  contract  modifications  to  include  the  required 
Federal  Acquisition  Regulation  Y2K  language  in  17  additional  contracts.  Three 
other  Air  Force  contracts  are  being  reviewed. 
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Chief  Information  Officer,  Air  Force 


Unified  Commands 


Commander  in  Chief,  U.  S 
Commander  in  Chief,  U.  S 
Commander  in  Chief,  U.S 
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Unified  Commands  (cont’d) 

Commander  in  Chief,  U.S.  Central  Command 
Commander  in  Chief,  U.S.  Space  Command 
Commander  in  Chief,  U.S.  Special  Operations  Command 
Commander  in  Chief,  U.  S  .  Transportation  Command 
Commander  in  Chief,  U.S.  Strategic  Command 


Other  Defense  Organizations 

Director,  Ballistic  Missile  Defense  Organization 

Chief  Information  Officer,  Ballistic  Missile  Defense  Organization 
Director,  Defense  Advanced  Research  Projects  Agency 

Chief  Information  Officer,  Defense  Advanced  Research  Projects  Agency 
Director,  Defense  Commissary  Agency 

Chief  Information  Officer,  Defense  Commissary  Agency 
Director,  Defense  Contract  Audit  Agency 

Chief  Information  Officer,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accounting  Service 

Chief  Information  Officer,  Defense  Finance  and  Accoimting  Service 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Mormation  Systems  Agency 
Chief  Information  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Legal  Services  Agency 

Chief  Information  Officer,  Defense  Legal  Services  Agency 
Director,  Defense  Logistics  Agency 

Chief  Information  Officer,  Defense  Logistics  Agency 
Director,  Defense  Security  Assistance  Agency 

Chief  Information  Officer,  Defense  Security  Assistance  Agency 
Director,  Defense  Security  Service 

Chief  Information  Officer,  Defense  Security  Service 
Director,  Defense  Special  Weapons  Agency 

Chief  Information  Officer,  Defense  Special  Weapons  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Director,  On-site  Inspection  Agency 

Chief  Information  Officer,  On-site  Inspection  Agency 
Inspector  General,  Defense  Intelligence  Agency 
Inspector  General,  National  Imagery  and  Mapping  Agency 
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Nqn-Defense  Federal  Organizations  and  Individuals 

Chief  Information  Officer,  General  Services  Administration 
Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 
Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division,  General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional  committees 
and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 

House  Subcommittee  on  Govenunent  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal  Justice, 
Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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Office  of  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and 
Intelligence)  Comments 


ASSISTANT  SECRETARY  OF  DEFENSE 
6000  DEFENSE  PENTAGON 
WASHINGTON.  DC  20301*6000 

January  12,  1 998 


COMMAND.  CONTROL, 
communications,  and 

INTELLIGENCE 


IVIEMORANDUM  FOR  INSPECTOR  GENERAL  OF  THE  DEPARTMENT  OF  DEFENSE 

SUBJECT:  Response  to  OIG,  DoD,  Draft  Audit  Report,  "Sharing  Year 

2000  Testing  Information  on  DoD  Information  Technology 
Systems,"  Project  No.  8AS“0004,  November  26,  1997 

Thank  you  for  the  opportunity  to  review  and  comment  on  your 
November  26,  1997,  draft  audit  report,  subject  as  above.  While 

we  concur  with  your  recommendation  that  one  organization  should 
provide  reliable  and  relevant  Year  2000  testing  information  for 
the  Department,  the  Joint  Interoperability  Test  Command  (JITC) 
within  the  Defense  Information  Systems  Agency  (DISA)  has  been 
given  this  responsibility  and  has  already  established  a  homepage 
on  the  internet. 

We  appreciate  the  opportunity  to  comment  on  this  draft 
report  and  request  that  you  incorporate  this  memorandum  along 
with  the  attachment  in  the  final  audit  report. 


pvnthonj^M.  Valletta 
(Actirlg) 


Attachment 
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Response  to  Office  of  the  Inspector  General  (OIG) ,  DoD  Draft 
Audit  Report  "Sharing  Year  2000  Testing  Information  on  DoD 
Information  Technology  Systems,*  Project  No.  8AS-0004, 
November  26,  1997 


Recommendation :  The  DoDIG  recommends  that  the  Chief  Information 

Officer  establish  a  DoD  sponsored  year  2000  testing  information 
center  within  the  DoD  responsible  for: 

1.  Gathering,  analyzing,  storing,  and  disseminating 
reliable  and  relevant  year  2000  testing  information. 

2.  Providing  year  2000  hotline  services  to  dod  Components. 

Response:  Concur  with  comment.  The  Acting  ASD(C3l)  has  already 

directed  the  Joint  Interoperability  Test  Command  (JITC)  within 
the  Defense  Information  Systems  Agency  (DISA)  to  be  the  focal 
point  for  this  and  maintain  a  homepage  that  addresses  Year  2000 
testing  information  for  all  of  DoD.  This  homepage,  located  at 
www.disa.mil/cio/y2k/jitc2000.htinl,  contains  topics  such  as  test 
methods,  vendor  provided  data,  links  to  y2K  tools,  and  lessons 
learned.  It  also  contains  links  to  other  Y2K  homepages,  such  as 
the  Social  Security  Administration  Year  2000  COTS  Data  Base. 
Although  JITC  has  not  instituted  a  formal  hotline  service,  it 
does  have  a  list  of  points  of  contact  and  will  assist  users  who 
call  or  e-mail  them. 


Final  Report 
Reference 


Renumbered 
as  Recom¬ 
mendations 
l.a.  and  l.b. 
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